Pharmaceuticals Exploration

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:52 AM UTC
• Version: 1.0.3

Overview

The skill’s pharmaceutical research behavior is coherent, but its setup asks users to put a live API key directly in an MCP URL, which can persist or leak through history, config, and logs.

Review this before installing if your PatSnap API key has paid quota or sensitive account access. Prefer a credential mechanism that does not store the key in a URL if PatSnap and your MCP client support it; otherwise use a least-privilege key, rotate it if it has already been pasted into command history or config, and expect queries to be sent to PatSnap MCP services during use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:33

Finding

API Credential Exposed Through URL Query Parameters

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 33–35; repeated at lines 72–75
Vulnerability Type: API credential exposure through insecure configuration
Risk Level: Medium

Vulnerable Code

bash

claude mcp add --transport http pharma_intelligence \
  "https://connect.patsnap.com/096456/logic-mcp?apiKey=sk-xxxxxxxxxxxx"

The same insecure credential-passing pattern is repeated in the connectivity-error guidance:

bash

claude mcp add --transport http pharma_intelligence \
  "https://connect.patsnap.com/096456/logic-mcp?apiKey=YOUR_API_KEY"

Technical Analysis

The setup instructions require users to insert a PatSnap API key directly into a URL query parameter. Although the URL uses HTTPS and therefore receives transport encryption, query-string credentials may still be retained outside the encrypted network channel.

The complete credential-bearing URL may be exposed through:

• Shell command history
• Claude MCP configuration or diagnostic output
• Process inspection while the setup command runs
• Proxy, gateway, load balancer, or server access logs
• Error reports, telemetry, screenshots, and support bundles
• Browser or monitoring records if the URL is reused outside the CLI

API keys are bearer credentials. Anyone who obtains the URL may be able to replay the key without possessing additional authentication factors. This behavior is related to the Skill's declared PatSnap integration, but placing the secret in the URL exceeds the minimum exposure necessary to authenticate requests.

No real hardcoded API key was present in the reviewed file; the displayed values are placeholders. The vulnerability arises when a user follows the instructions and substitutes a live credential.

Attack Path

1. A user follows the setup instructions and replaces the placeholder with a valid PatSnap API key.
2. The credential-bearing command is saved in shell history, MCP config ...[truncated 1245 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove API keys from URL query parameters. Prefer an HTTP authorization header, such as Authorization: Bearer, if supported by the service and MCP client.
2. Use protected secret storage. Configure the MCP connection through an operating-system keychain, MCP secret-reference facility, or another credential manager rather than embedding the key directly in configuration.
3. Avoid command-line expansion of secrets. If environment variables must be used, ensure the client resolves the secret securely without persisting the expanded value in shell history, process arguments, or generated configuration.
4. Redact credentials from telemetry and logs. Explicitly filter apiKey, authorization headers, and credential-bearing URLs from client, proxy, gateway, server, and diagnostic logs.
5. Apply least privilege to issued keys. Restrict each key to the minimum APIs, datasets, quotas, and account permissions required by this Skill.
6. Support credential lifecycle controls. Document key rotation and immediate revocation procedures, and use short-lived credentials where supported.
7. Update both affected examples. Replace the setup command at lines 33–35 and the error-guidance command at lines 72–75 so users are not directed back to the insecure pattern.
8. Warn existing users to rotate exposed keys. Keys previously entered into URL-based configurations should be revoked and replaced after shell histories, configurations, and relevant logs are sanitized.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation criteria are broad enough to trigger on generic drug, disease, or target mentions and even via other skills, which increases the chance this skill runs in contexts the user did not clearly request. In a tool-rich skill that can query external MCP services and perform extensive cross-domain retrieval, over-activation can cause unnecessary external data access, unintended disclosure of user query context to third-party services, and confusion or policy bypass through inappropriate routing.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 310)May include surrounding context.

md

**When to use**: After completing Condition Search and Vector Search, assess whether the results are sufficient from
three dimensions:

| Dimension             | Description                                                                                |
|-----------------------|--------------------------------------------------------------------------------------------|
| Coverage completeness | Does it cover all key points of the user's query?                                          |
| Data depth            | Is there sufficient detail and data to support the answer?                                 |

Static analysis

No suspicious patterns detected.